DE102006027682B3 - Integrated circuit arrangement and method for operating an integrated circuit arrangement - Google Patents

Abstract

An integrated circuit arrangement comprises a test line (2) and a test signal generator (1), which is coupled to the test line (2) and is designed to give a test signal (S) to the test line (2). Furthermore, a comparison unit (3) with an input for applying a clock signal (T) is provided, which is coupled to the test line (2) and is designed to supply a transit time (L) of the test signal (S) via the test line (2) detect and check whether the clock signal (T) and the transit time (L) are in a predetermined relationship.

Description

The The invention relates to an integrated circuit arrangement to the Frequency of a clock signal to check, and a method of operating such a circuit arrangement.

at Microcontrollers for Safety-relevant applications are often an internal circuit Clock signal generation provided. Alternatively, to operate the corresponding chip also has an external clock signal to it Interfaces are created. An external clock signal becomes, for example also used for communication with the chip.

advantage The internal clock signal generation is that this operation of the Allows chips at high frequencies, even if the externally, for example, for communication, created Clock frequency is lower.

Of Further protects the internal clock signal generation before an attack. On the one hand is in a circuit arrangement with an internal clock signal generation the synchronization of applied signals for the purpose of attack difficult. On the other hand, it is not readily possible, the reduce internal clock in the context of the attack.

disadvantage such a circuit arrangement with internal clock signal generation is the difficulty of the clock frequency of the internal clock signal to test.

So far the clock frequency is compared by means of two frequency sensors detected. The one frequency sensor detects with respect to lower limit frequency and the other frequency sensor detected in terms an upper limit frequency. Disadvantage of this arrangement is that both Frequency sensors can be the target of an attack. Another disadvantage is that with the frequency sensors also a correspondingly higher power consumption the circuit goes along.

One another approach to checking the internal clock involves this with a to compare external clock. For this purpose, a register is provided. Such protects an arrangement but not against an attack in which the frequency of the external Takts is reduced, which is easily possible. Because it will also reduces the frequency of the internal clock.

From the US 2005/0218401 A1 an arrangement with a test line, a test signal generator and a comparison unit is known, in which the transit time of the test signal is determined via the test line by means of a transit time comparison of a clock signal over a reference distance.

From the DE 19938060 A1 a test device is known whose operation is based on runtime comparisons. From the EP 1182702 A1 is a so-called active shield known in which signals are transmitted via test lines.

It Object of the invention, a circuit arrangement for reliably checking a Clock frequency provide and a method for operating such to provide a circuit arrangement.

The solution The object is achieved by a circuit arrangement and a method according to the siblings Claims.

The Integrated circuit arrangement comprises a test line and a Test signal generator which is coupled to the test line and is designed to give a test signal to the test lead. The circuit arrangement further comprises a comparison unit having an input for application a clock signal, wherein the comparison unit to the test line is coupled and is formed, a duration of the test signal on the Test line to detect and check if the clock signal and the term are in a given context. The comparison unit Detects whether the running time of the signal via the test line at least is a predetermined first multiple of the clock period of the clock signal and a maximum of a predetermined second multiple of the clock duration of the Clock signal is.

This Comparison has the advantage that with increasing length of the Conduction of relative errors due to line or mismatch Measurement error reduced.

Of the given context, for example, a duration that the Signal over need the test line is, is by a storage means or via an input to the comparison unit provided.

advantage This arrangement is that a reference signal for comparison with the clock signal in a part independent of the clock signal generation the circuit arrangement is generated. Here is the term of the test signal the test lead as reference.

This Approach is based on the very stable and on the function of the circuit independent term over the Test line. The duration depends of the length the test line.

Advantageously, the comparison unit comprises a counter whose opening time is controlled by the duration of the signal. During the opening time, clocks of the input side of the Counting unit adjacent clock signal to be counted, ie while the test signal is running on the test line, the clocks are counted. In this way, a simple comparison is possible by comparing the number of counted clocks with a predetermined comparison value or a comparison value range.

The Test line can be arranged running back and forth or meandering be to the required length to place the test lead on a limited space.

advantageously, is the test line in an upper layer of the integrated circuit arranged. In this way, the test line covers the underneath lying residual circuitry and prevents visual Spähangriffe on their functioning. This arrangement of the test line forms a sign out. It is for spying on the circuit In this case, it is necessary to manipulate the test line, for example by bridging the test line Test lead and ablation of the bridged areas. An accompanying change the runtime, is compared with the given comparison value determined and lets to close an attack. Of course will also interrupt the test lead, based on the no more detectable test signal that has been put on the test lead is detected.

In a particularly advantageous embodiment is the test line formed as part of an active shield. In this case can not just the test signal for determining the transit time over the Test lead to be given. Rather, especially during the Operation of the circuit arrangement, further test signals over the Test lead given and detected. Based on a difference between the imprinted Signal and the detected signal settles on an attack shut down. Suitable test signals for such an embodiment are, for example, random sequences or predetermined bit patterns.

advantageously, the comparison unit is so coupled to the clock signal generator, that the clock frequency is based on a reference clock frequency maturity is regulated. Such a regulation can take place by providing a control signal from the comparison unit which contains information, whether the current clock frequency higher or lower than the predetermined reference clock frequency.

• – Übertragen eines Testsignals über eine Testleitung,
• – Detektieren einer Laufzeit des Testsignals und
• – Überprüfen, ob das Taktsignal und die Laufzeit in einem vorgegebenen Zusammenhang stehen. Kennzeichnenderweise wird detektiert, ob die Laufzeit mindestens ein vorgegebenes erstes Vielfaches der Taktdauer des Taktsignals ist und maximal ein vorgegebenes zweites Vielfaches der Taktdauer des Taktsignals ist. Da beim Verfahren detektiert wird, ob die Taktdauer des Taktsignals ein Vielfaches der Laufzeit ist, können auch hohe Taktfrequenzen mit guter Genauigkeit geprüft werden.

The method according to the invention for checking the clock frequency of a clock signal comprises the following steps:

• Transmitting a test signal via a test line,
• - Detecting a running time of the test signal and
• - Check whether the clock signal and the runtime are in a given context. Significantly, it is detected whether the delay is at least a predetermined first multiple of the clock duration of the clock signal and a maximum of a predetermined second multiple of the clock duration of the clock signal. Since the method detects whether the clock duration of the clock signal is a multiple of the delay, even high clock frequencies can be checked with good accuracy.

advantageous Circuit arrangements result from the subordinate claims.

On easy way lets Detecting can be accomplished by the number of bars while the runtime counted become.

Based the test signal and its duration are possible conclusions about whether the test line in terms of their length has been manipulated or interrupted.

Based the delay advantageously becomes the clock frequency of the clock signal Controlled, since it also contains information, whether the current Clock signal frequency above or below the predetermined value is.

following the invention with reference to the drawing based on embodiments explained.

It demonstrate:

1 1 is a schematic circuit diagram of a first embodiment of an integrated circuit arrangement,

2 Waveforms of signals within the circuit and

3 a schematic diagram of a second embodiment of an integrated circuit arrangement.

1 shows a schematic diagram of an integrated circuit arrangement for checking a clock signal T. The circuit arrangement comprises a test signal generator 1 , This test signal generator 1 is to a test lead 2 coupled. Further, a comparison unit 3 provided to the test signal generator 1 and to the test line 2 is coupled.

The test signal generator 1 generates a test signal S, that on the test line 2 is given. Due to a finite duration of the test signal S via the test line 2 becomes the test signal S from the comparison unit 3 only detected after a finite time. The time difference between the imposition of the test signal S on the beginning P_S1 of the test line 2 and the detection at the end P_S2 of the test line 2 is called runtime. The transit time of the test signal S depends on the length of the test line 2 from.

The longer the test lead 2 is, the greater the runtime. The longer the runtime, the less measurement errors and system-inherent variations in runtime are involved. Thus, it is advantageous that the term as reference signal - is as large as possible. This goes with a long test lead 2 associated. Such a long test lead 2 can be formed, for example, on an integrated circuit by the test line 2 runs back and forth or meandering. This is in 1 indicated.

Furthermore, in the circuit arrangement in 1 a clock signal generator 4 provided which outputs a clock signal T, that of the comparison unit 3 is supplied.

The clock signal generator 4 not only sets the clock signal T to the comparison unit 3 ready, but also a variety of other circuit units within the integrated circuit, their representation in 1 has been omitted. The internal operation and the communication of the circuit units takes place with this internal clock T.

In what way the clock frequency of the clock signal T a predetermined clock frequency corresponds, can be by a comparison of the clock signal T and the transit time of the test signal Determine S This will be explained below.

2 shows exemplary relationships between the test signal S and the clock signal T.

The signal S1 is the time profile of the test signal S at the beginning of the test line 2 shown. This place is in 1 marked with the reference symbol P_S1. For example, the test signal S is a pulse or a jump function, since edges can be easily detected.

The signal S2 is the time profile of the test signal S at the end of the test line, that of the comparison unit after passing through the test line 2 is detected, shown. This place is in 1 marked with the reference character PS_2. Due to the propagation delay over the test line 2 there is a time difference L between the edges of the signal S1 and the signal S2.

2 also shows two exemplary clock signals T1 and T2, which differ in their pulse duration TT1 or TT2 and in their period D1 or D2. Usually, the pulse duration of the clock signal T is much less than the delay L. This is in 2 only hinted.

The comparison device 3 checks whether the clock signal T is in a given context at runtime L. From this it can be concluded whether the clock frequency of the clock signal T fulfills the given requirements or possibly an attack is present.

For verification different approaches are possible. For example, it can be checked whether a predetermined number of pulses of the clock signal T is provided within the transit time L. If fluctuations in the clock frequency are tolerated, it can be checked whether the number of pulses is within specified limits. The predetermined comparison value or the comparison value range is in a register 10 saved.

alternative especially with smaller differences between the pulse duration and the term are determined, whether a predetermined, for example integer, multiple of the pulse duration within the term is. This would be at the signal T1 the case by exactly two periods D1 within the term L are.

At the Signal T2 is the period D2 longer, so it's not possible is to detect two periods D2 within the term L.

of course is also an indirect measurement of the number of cycles during the Runtime conceivable by being dependent from the term a reference signal is generated, for example supplied to an integrator becomes.

3 shows a further embodiment of the circuit arrangement as a schematic. Circuit diagram in perspective view.

Same Reference numerals indicate the same arrangement parts. To avoid Repetitions no duplicate description is consistent Arrangements.

In the 3 illustrated circuitry includes two trace or metallization levels. Of course, it is also conceivable that an integrated circuit arrangement includes even more levels. At the top level is the test lead 2 arranged as a shield so that areas of the Testlei tung 2 are closely adjacent and run back and forth and cover the underlying circuitry. In the area protected by the shield sections of the test line run 2 closely adjacent to protect the underlying areas. By this arrangement, the shield effect is achieved.

To attack the underlying circuitry areas 5 . 6 would need to run the test line 2 either severed or bridged. The former would go hand in hand with a change in the running time L. The latter would make the detection of the term impossible. In the former case, there is almost inevitably a difference to the detected clock frequency, since it is extremely difficult the test line length 2 and to manipulate the clock in an adapted manner. The difference between the runtime L and the internal clock frequency suggests an attack.

In such a case, the circuit arrangement may be formed suitable countermeasures, for example, restarting or performing appropriate defensive actions, z. B. Delete from Registers, perform.

In addition to the other circuit units 5 . 6 that is below the level with the test lead 2 are arranged, the circuit arrangement also comprises a signal generator 8th , With the signal generator 8th can send more signals via the test line 2 be given, for example, random sequences. A difference between the impressed signals and the detected signals indicates an attack. By this arrangement, an active shield is formed.

Of course it is also possible, by means of the test line 2 to monitor an external clock. In this case is a connection 9 for applying the external clock to the comparator 3 coupled.

The embodiment of the comparison device 3 includes a counter 11 , its gate time or opening time by the transit time over the test line 2 is given. During the run time L, the clock cycles of the applied clock signal T in the counter 11 summed. If the counter 11 If, for example, it is too high or low after the opening time has elapsed, an alarm is triggered or a register is set to indicate this event.

The result of the runtime comparison can also serve to the clock frequency of the clock signal generator 4 provided clock signal T to the predetermined clock frequency. In this case, the number of clocks is used as information as to how the current clock frequency deviates from the given one. The comparison unit may be designed to regulate the clock signal as a function of this information or to provide the information as a control signal to a corresponding control device.

1

Test signal generator

2

test line

3

comparing unit

4

Clock signal generator

5, 6

circuit units

8th

signal generator

9

connection

10

register

11

counter

S, S1, S2

signal

T T1, T2

clock signal

L

running time

P_S1

Test line beginning

P_S2

Test cable end

D1, D2

period

TT1, TT2

pulse duration

t

Time

Claims (14)

Integrated circuit arrangement with - a test line ( 2 ), - a test signal generator ( 1 ), to the test line ( 2 ) and is adapted to apply a test signal (S) to the test line ( 2 ) and - a comparison unit ( 3 ) with an input for applying a clock signal (T), wherein the comparison unit ( 3 ) to the test line ( 2 ) and is configured, a transit time (L) of the test signal (S) via the test line ( 2 ) and to check whether the clock signal (T) and the transit time (L) are in a predetermined relationship, characterized in that the comparison unit ( 3 ) detects whether the transit time (L) is at least a predetermined first multiple of the clock duration of the clock signal (T) and a maximum of a predetermined second multiple of the clock duration of the clock signal (T). Integrated circuit arrangement according to Claim 1, characterized in that the comparison unit ( 3 ) a counter ( 11 ) which counts the number of clocks of the clock signal (T) during the runtime (L) of the test signal (S). Integrated circuit arrangement according to claim 2, characterized in that the comparison unit ( 3 ) checks whether the counted clocks match a comparison value or are within a predetermined comparison value range. Integrated circuit arrangement according to An claim 3, characterized in that a register ( 10 ) for providing the comparison value or the comparison value range for the comparison unit ( 3 ) is provided. Integrated circuit arrangement according to one of Claims 1 to 4, characterized in that the test line ( 2 ) is arranged to run back and forth. Integrated circuit arrangement according to one of Claims 1 to 5, characterized in that the test line ( 2 ) is disposed in an upper conductive layer of the integrated circuit device. Integrated circuit arrangement according to one of Claims 1 to 6, characterized in that the test line ( 2 ) is formed as part of an active shield. Integrated circuit arrangement according to one of Claims 1 to 7, characterized in that a clock signal generator which generates the clock signal (T) ( 4 ) to the comparison unit ( 3 ) is coupled. Integrated circuit arrangement according to claim 8, characterized in that the clock frequency of the clock signal (T) by the comparison unit ( 3 ) is regulated. Integrated circuit arrangement according to one of Claims 1 to 9, characterized by a connection ( 9 ) for applying an external clock signal to the comparison unit ( 3 ) is coupled. Method for checking a clock signal frequency of a clock signal (T), comprising - transmitting a test signal (S) via a test line ( 2 ), - detecting a transit time (T) of the test signal (S) and - checking whether the clock signal (T) and the transit time (L) are in a predetermined relationship, characterized in that it is detected whether the transit time (L) at least a predetermined first multiple of the clock duration of the clock signal (T) and a maximum of a predetermined second multiple of the clock duration of the clock signal (T) is. Method according to claim 11, characterized in that that the number of bars during the running time (L) counted becomes. Method according to claim 12, characterized in that that is being checked whether the counted bars match a comparison value or within a predetermined comparison value range. Method according to one of claims 11 to 13, characterized the clock frequency of the clock signal (T) depends on the transit time (L) of the clock signal Test signal (S) is regulated.